AI-assisted offensive operations

Published AI security tools that sources report being used in malicious operations. A tool here is a published security tool, never labelled malware; its malicious use exists only where a source reports it, and a shared tool links no actors, campaigns or victims.

Tools

Actor attribution statements

Each statement is the named vendor's assessment, kept as such: ICHI has not confirmed any attribution independently.

Evidence levels

• Observed: the source states it saw it in its own investigation or telemetry.
• Alleged: the source reports it, or relays another organisation's reporting.
• Inferred: the source's analytic judgement ("assesses", "likely").

Sources

Data: tools (JSON) · attribution statements (JSON). No tool code is fetched, cloned or run, and no repository is scanned.